All nine Italian cities in the European mission “100 climate-neutral and smart cities by 2030” have now obtained the Mission Label. But the opening of the cities to the digital has also met its first, severe legal test: the Garante’s sanction against the Municipality of Trento for the “intelligent” surveillance projects Marvel and Protector. Between European funds and fundamental rights, how is the Italian smart city taking shape?
Many Italian cities are opening up to the digital. But how? Between the roll-out of European projects and university research, the smart city develops; and, as we will see, so does its legal counterweight.
Climate-neutral and smart cities: the Mission Label
In 2022 the European Commission announced the cities taking part in the mission “100 climate-neutral and smart cities by 2030”: for Italy, Bergamo, Bologna, Florence, Milan, Padua, Parma, Prato, Rome and Turin. Four years on, the outcome is anything but symbolic. With its October 2025 announcements the Commission stated that “the total of labelled cities has now reached 103”, with 10 awarded in October 2023, 23 in March 2024, 20 in October 2024 and 39 in May 2025. The Mission Label, which certifies the credibility of the cities’ climate-neutrality plans (the Climate City Contracts), unlocks access to the Climate City Capital Hub and to “a dedicated €2 billion lending envelope” of the European Investment Bank.
As for the Italian cities, the path is now complete for all nine: Florence and Parma labelled in March 2024; Bologna, Bergamo, Milan, Prato and Turin in October 2024; Padua in May 2025; and Rome, last, in October 2025.
Trento as pilot city: Marvel, Protector, Precrisis
Among the various urban-digitalisation projects, one in particular had caught our attention: that of the city of Trento. Thanks to EU funds for smart-city development, Trento — together with the Bruno Kessler Foundation — was the pilot city for three research projects: Marvel, Protector and Precrisis. From traffic control to the prevention of petty crime and the management of crowds at large events, AI algorithms were to allow the city to collect and analyse large amounts of data from public spaces. As early as May 2023 the Municipality had felt the need to take a public stance on the three projects, in the face of Orwellian concerns about mass video-surveillance carried out at the expense of residents’ rights, under the guise of urban security.
The Garante’s lesson: the decision of 11 January 2024
Those concerns were confirmed by the Authority’s intervention. With its decision of 11 January 2024 (made public on 25 January 2024), the Garante fined the Municipality of Trento €50,000, also ordering it to “erase the data processed unlawfully”, in relation to the Marvel and Protector projects. The Authority’s findings deserve to be reported: first, the lack of a legal basis — “the Municipality of Trento, which does not count scientific research among its institutional purposes, did not demonstrate the existence of any legal framework suitable to justify the processing of personal data — including data relating to offences and special categories”. Second, the inadequacy of the measures — “the anonymisation techniques used to reduce the possible re-identification risks also proved insufficient”. Third, the absence of an impact assessment — “the Municipality did not prove that it had carried out an impact assessment before starting the processing”.
As to the object, project Marvel entailed processing video-surveillance footage and “audio obtained from microphones specifically placed on public streets”, while Protector also included “the collection and analysis of hate messages and comments published on social media”. But it is in the closing passage that the decision assumes a scope transcending the individual case: the Garante stigmatised “the massive and invasive processing carried out”, observing that “such forms of surveillance in public spaces may alter people’s behaviour and also condition the exercise of democratic freedoms”. Nor did the Trento case remain isolated: the Authority subsequently opened investigations into a facial-recognition video-surveillance project in Rome’s metro stations and into Turin’s “intelligent” cameras. Algorithmic urban surveillance has clearly entered the enforcement agenda for good.
Conclusions
The two trajectories we have described — the Mission Labels and the Trento decision — are not in contradiction: they are two sides of the same coin. The smart, climate-neutral city is a funded and structured European goal; but a city’s intelligence cannot be built on the surveillance of its inhabitants. Scientific research, the Garante recalled, is not an institutional purpose of the Municipality: whoever processes personal data in public spaces must be able to show a suitable legal basis, effective measures against re-identification and a prior impact assessment. To this is now added the AI Act, with prohibitions already applicable since 2 February 2025 and the high-risk regime on the horizon.
In the light of the above, one wonders whether Italian cities will manage to hold together the two souls of the transition — the climate-digital one and the rights one — subordinating every processing of data in public spaces to a suitable legal basis, to effective measures against re-identification and to a prior impact assessment, so that urban innovation does not turn into surveillance of the city’s own inhabitants.